3 ms·
it kind of sucks that cloudflare can't check the servername for the certificate he wants to use. i haven't used cloudflare but I assume there are three ways it
by benmmurphy 10y ago
it kind of sucks that cloudflare can't check the servername for the certificate he wants to use. i haven't used cloudflare but I assume there are three ways it might be checking the cert at the backend:
1) using the real hostname of the website
2) using the hostname of the backend website - assuming you supply a url with a hostname to cloudflare. however, this hostname in the backend url is used in the Host header which ends up causing lots of problems.
3) using the hostname of the backend website - but the hostname of the real site is used in the Host header.
4) explicitly let you choose the servername you want to verify
imo. it would be nice if cloudflare gave you the option between 1) and 3) or 4).
EDIT: oh. just noticed the cloudflare reply with the link to: https://blog.cloudflare.com/cloudflare-ca-encryption-origin/ https://blog.cloudflare.com/cloudflare-ca-encryption-origin/
- drdaeman 10y agoIt shouldn't rely on server name, but on the actual key or signature. Actually, I believe many of hosts running behind the CloudFlare wouldn't want to expose any meaningful server names, so the actual server location would be harder to spot. I.e. you generate your keypair and produce a self-signed certificate, you should be able to give your public key and the actual key would be used for authentication. The subject (and SANs) of the certificate are ignored so it could be like "/CN=localhost" - only the key material is what matters here. That would be secure - in a sense third-party attacker won't be able to sniff what's between you and CloudFlare. (Or you could generate your own (self-signed) CA, generate a certificate signed by this CA of yours, and give CloudFlare your CA's public key. This makes sense if you have multiple hosts and you don't want to share the same key.)